Advisory catalog

Public source statements across vendors. Explicit aliases connect records; each publisher keeps its own state, severity and affected-version evidence.

Collected statements

678350 source statements · aliases may refer to the same vulnerability

MAL-2026-18254Published

Malicious code in appit-cordova-plugin-ionic (npm)

osv · GHSA-fr38-45mf-vcqf

npm: appit-cordova-plugin-ionic

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18255Published

Malicious code in cert-infos (npm)

osv · GHSA-8mjx-r4j6-3h6g

npm: cert-infos

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18269Published

Malicious code in youtube-info-streams (npm)

osv · GHSA-7mfw-r26v-9r9f

npm: youtube-info-streams

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18260Published

Malicious code in ionic-sound-cloud-loader-api (npm)

osv · GHSA-g89m-8c48-9x73

npm: ionic-sound-cloud-loader-api

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18270Published

Malicious code in youtube-search-without-api-key (npm)

osv · GHSA-f6m2-r9qr-44fx

npm: youtube-search-without-api-key

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18253Published

Malicious code in appit-cordova-admob (npm)

osv · GHSA-9w8h-674f-4x2j

npm: appit-cordova-admob

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18266Published

Malicious code in redis-dumper (npm)

osv · GHSA-8gg8-xq45-8fx5

npm: redis-dumper

Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116050Published

krupalshah Employee Recruitment System Registration registerform3.php sql injection

cve-program ·

Vendor product: Employee Recruitment System

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116048Published

krupalshah EmployeeRecruitmentSystem Registration registerform1.php mysql_query sql injection

cve-program ·

Vendor product: EmployeeRecruitmentSystem

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116047Published

Privoce Vocechat Query Parameter widget.html cross site scripting

cve-program ·

Vendor product: Vocechat

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-105164Published

NASA cFS cfe_fs_api.c CFE_FS_ParseInputFileNameEx out-of-bounds

cve-program ·

Vendor product: cFS

CVSS 4.0 5.1 · CVSS 3.1 2.7 · CVSS 3.0 2.7 · CVSS 2.0 3.3Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116045Published

1999AZZAR designer-mcp MCP motion-dev-guidelines.md get_reference path traversal

cve-program ·

Vendor product: designer-mcp

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 4.0Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116044Published

prasathmani TinyFileManager Remote URL File Upload tinyfilemanager.php unrestricted upload

cve-program ·

Vendor product: TinyFileManager

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-114820Published

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u511-b32, 8u511-perf-b32, 11.0.33.0.2, 17…

cve-program ·

Vendor product: Oracle Java SE · Vendor product: Oracle GraalVM for JDK · Vendor product: Oracle GraalVM Enterprise Edition

CVSS 3.1 9.1Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116006Published

YunaiV/zhijiantianya ruoyi-vue-pro SMS Code Verification AuthController.java improper authentication

cve-program ·

Vendor product: ruoyi-vue-pro · Vendor product: ruoyi-vue-pro

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-116004Published

onyx-dot-app Onyx PreviewTab.tsx cross site scripting

cve-program ·

Vendor product: Onyx

CVSS 4.0 5.1 · CVSS 3.1 3.5 · CVSS 3.0 3.5 · CVSS 2.0 4.0Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-115999Published

mansi-k Restaurant_IMS lsmodal.php mysqli_connect sql injection

cve-program ·

Vendor product: Restaurant_IMS

CVSS 4.0 6.9 · CVSS 3.1 7.3 · CVSS 3.0 7.3 · CVSS 2.0 7.5Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18251Published

Malicious code in tailwindcss-theme-kit (npm)

osv · GHSA-v5xr-xjx7-ggwf

npm: tailwindcss-theme-kit

Source modified 25 Oct 2026Recorded 25 Oct 2026

MAL-2026-18250Published

Malicious code in tailwind-base-buttons (npm)

osv · GHSA-5j43-343m-gggg

npm: tailwind-base-buttons

Source modified 25 Oct 2026Recorded 25 Oct 2026

CVE-2026-115997Published

pig-mesh pig SqlFilterArgumentResolver.java orderItem.getColumn sql injection

cve-program ·

Vendor product: pig

CVSS 4.0 5.3 · CVSS 3.1 6.3 · CVSS 3.0 6.3 · CVSS 2.0 6.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-58661Published

n8n before 2.28.0 (and before 1.123.58 on the 1.x branch) contains a disk space exhaustion vulnerability in the data-table file upload endpoint. The per-request quota check does not account for files already written to the shared temporary …

nvd ·

CVSS 4.0 · [email protected] · Secondary 5.3 · CVSS 3.1 · [email protected] · Primary 4.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-111326Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-109111Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-89284Rejected

This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.

cve-program ·

Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-115995Published

Unitree Robotics Unitree Go2 chat_go gpt_thread.py set_volume os command injection

cve-program ·

Vendor product: Unitree Go2

CVSS 4.0 9.4 · CVSS 3.1 9.6 · CVSS 3.0 9.6 · CVSS 2.0 10.0Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-27690Published

Due to an HTTP Request Smuggling vulnerability in SAP Approuter, an unauthenticated attacker could send a specially crafted HTTP request that leads to request-response desynchronization. This could result in the exposure of user responses a…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-44745Published

SAP Approuter does not properly validate incoming request headers during the OAuth2 login flow under certain configurations. This allows an unauthenticated remote attacker to craft a malicious link which, when clicked by a victim, could lea…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-56353Published

n8n contains an authentication bypass in the Chat Trigger node when configured with n8n User Auth (a non-default configuration). In affected releases — before 1.123.22, the 2.0.0 through 2.9.2 line, and 2.10.0 — the authentication check on …

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Secondary 4.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-56764Published

Hono before 4.11.10 contains a timing attack vulnerability in the basicAuth and bearerAuth middlewares due to non-constant-time string comparison in the timingSafeEqual function. Attackers can exploit early termination of string equality ch…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Secondary 3.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-58500Published

MCP Appium is an MCP server that provides AI assistants with tools to automate mobile app testing on Android and iOS. In versions prior to 1.85.10, the createLocatorGeneratorUI function interpolates attacker-controlled element attributes — …

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-59801Published

9Router through version 0.4.41 contains an unauthenticated access vulnerability that allows remote attackers to interact with provider management API endpoints by sending requests without any credentials due to missing authentication middle…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 9.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-62187Published

OpenClaw Feishu tools (npm package @openclaw/feishu) in versions <= 2026.6.6 could ignore per-account disablement. A lower-trust caller or a configured input path could perform actions that should have required a stronger authorization or p…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Secondary 8.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-62188Published

OpenClaw @openclaw/feishu versions 2026.6.6 and earlier contain an incorrect authorization vulnerability in which the Feishu permission tools could ignore per-account disablement settings. When the affected feature is enabled and reachable,…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.6 · CVSS 3.1 · [email protected] · Secondary 8.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-62327Published

9Router through version 0.4.41 contains an unauthenticated information disclosure vulnerability that allows remote attackers to retrieve plaintext API keys for all connected AI provider accounts by sending a single unauthenticated request t…

nvd ·

CVSS 4.0 · [email protected] · Secondary 9.3 · CVSS 3.1 · [email protected] · Secondary 9.1Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-62328Published

9Router through version 0.4.41 contain an unauthenticated information disclosure vulnerability that allows remote attackers to access sensitive user data by sending requests to unprotected API endpoints. Attackers can enumerate paginated re…

nvd ·

CVSS 4.0 · [email protected] · Secondary 8.7 · CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-115982Published

phpIPAM Rack Link Creation show-rack-popup.php create_rack_link cross site scripting

cve-program ·

Vendor product: phpIPAM

CVSS 4.0 5.3 · CVSS 3.1 4.3 · CVSS 3.0 4.3 · CVSS 2.0 5.0Source modified 24 Oct 2026Recorded 24 Oct 2026

CVE-2026-15895Published

OS command injection in the npm package loading component in AWS jsii-diff before 1.131.0 might allow context-dependent attackers to execute arbitrary commands via crafted package specifiers passed to the npm: source argument.

nvd ·

CVSS 4.0 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 8.4 · CVSS 3.1 · ff89ba41-3aa1-4d27-914a-91399e9639e5 · Secondary 7.8Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-45737Published

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. From 3.2.0 until 3.2.12, 3.3.10, and 3.4.2, Argo CD ServerSideDiff can expose Kubernetes Secret values embedded in the kubectl.kubernetes.io/last-applied-configuratio…

nvd ·

CVSS 3.1 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 6.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-45738Published

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Prior to 3.2.12, 3.3.10, and 3.4.2, Argo CD users with application write access can set link.argocd.argoproj.io/* annotations whose pipe-separated values are rendered…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.3 · CVSS 3.1 · [email protected] · Primary 8.7Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-46339Published

9Router is an AI router & token saver. From 0.4.30 until 0.4.37, 9Router's src/proxy.js middleware did not protect /api/cli-tools/* and /api/mcp/*, allowing unauthenticated registration of customPlugins through src/app/api/cli-tools/cowork-…

nvd ·

CVSS 3.1 · [email protected] · Secondary 10.0Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-47423Published

DOMPurify is a DOM-only cross-site scripting sanitizer for HTML, MathML, and SVG. In 3.4.4, DOMPurify allowed selectedcontent by default, allowing browsers to re-clone an XSS payload after sanitization so that unsanitized markup inside <sel…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.2Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-47428Published

Vitest is a testing framework powered by Vite. From 4.0.17 until 4.1.6 and 5.0.0-beta.3, Vitest Browser Mode served /__vitest_test__/ with the otelCarrier query parameter inserted directly into an inline module script, allowing a crafted br…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.6Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-47429Published

Vitest is a testing framework powered by Vite. Prior to 3.2.5 and 4.1.0, the Vitest UI/API server on Windows used isFileServingAllowed incorrectly for /__vitest_attachment__, allowing \\?\\..\\ path traversal to read files outside the proje…

nvd ·

CVSS 3.1 · [email protected] · Secondary 9.8 · CVSS 3.1 · [email protected] · Primary 5.9Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-47703Published

AdGuard Home is a network-wide software for blocking ads and tracking. Prior to 0.107.75, AdGuard Home's client-triggered DoQ forwarding path to a udp:// upstream reduced backend UDP DNS state by producing dns_id=0 or txid=0 and exposed a q…

nvd ·

CVSS 4.0 · [email protected] · Secondary 6.3 · CVSS 3.1 · [email protected] · Primary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-48038Published

joi is a schema description language and data validator for JavaScript. Prior to 17.13.4 and 18.2.1, denial of service is possible via an untrapped exception in services validating user-supplied JSON or object input with recursive link() sc…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-48068Published

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming HTTP/2 stream initiation can cause a server process created…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-48069Published

@grpc/grps-js implements the core functionality of gRPC purely in JavaScript, without a C++ addon. Prior to 1.9.16, 1.10.12, 1.11.4, 1.12.7, 1.13.5, and 1.14.4, an invalid incoming compressed message can cause a client or server process tha…

nvd ·

CVSS 3.1 · [email protected] · Secondary 7.5Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-48125Published

UAParser.js is a JavaScript library to detect browsers, operating systems, CPUs, and devices from user-agent data. From 2.0.1 until 2.0.10, a regular expression denial-of-service vulnerability exists when using the Client Hints API. By send…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.3Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-48758Published

sigstore-js provides JavaScript libraries for interacting with Sigstore services. Prior to 3.2.1, the preAuthEncoding function in @sigstore/core uses Node.js ascii encoding when converting the PAE string to bytes, allowing payloadType to be…

nvd ·

CVSS 3.1 · [email protected] · Secondary 5.4Source modified 24 Oct 2026Recorded 25 Oct 2026

CVE-2026-48795Published

AdonisJS is a TypeScript-first web framework. From 10.1.3 until 10.1.5 and 11.0.3, AdonisJS @adonisjs/bodyparser incompletely fixed CVE-2026-25754 because nested multipart field payloads such as user.proto.polluted and constructor.proto…

nvd ·

CVSS 3.1 · [email protected] · Secondary 8.6Source modified 24 Oct 2026Recorded 25 Oct 2026

A catalog match establishes published evidence, not applicability to your environment. Check resolved package dependencies, or open a Microsoft CVE for fixing KBs, releases and planning.